What is the CVSS score of CVE-2026-61070?

CVE-2026-61070 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

PeopleSoft Enterprise FIN CVE-2026-61070

EUVD-2026-47281 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-rmp3-jqxc-95v4

Denial Of Service Oracle Peoplesoft Enterprise Fin Common Objects

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated HTTP endpoint with partial availability impact only; no confidentiality or integrity effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:27 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

The affected product is Oracle PeopleSoft Enterprise FIN Common Objects Argentina version 9.1, a region-specific financial ERP module providing Cash Management functionality. The vulnerability resides in the Cash Management component, accessible over HTTP without authentication. No CWE has been assigned, preventing precise root-cause classification; however, the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a straightforward network-reachable condition that can degrade service availability without crossing a scope boundary or affecting data confidentiality or integrity. The Argentina-specific designation suggests localized financial logic (e.g., regional regulatory or payment processing features) that may not be present in standard PeopleSoft FIN deployments globally.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability per the official advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed from the available data beyond the CPU reference - consult Oracle Support for the specific patch identifier. As a compensating control where patching cannot be applied immediately, restricting network-level access to PeopleSoft HTTP endpoints (e.g., via firewall rules or reverse-proxy ACLs limiting Cash Management component URLs to authorized IP ranges) would reduce the unauthenticated attack surface; note this may impact legitimate users who require remote access. No other vendor-documented workarounds are present in the available data.